marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

S25: HSM custody, sync.pfc, georgelambert.org/pfc deep links
Some checks are pending
review / inventory (push) Waiting to run
Details

Browse source 
UserReview leftovers implemented without rewriting 70 website repos
and without fail-closing pfc-py-admin.
This commit is contained in:
George Lambert 2026-09-15 23:19:44 -04:00
parent 8c09abecae
commit aa7c837493
9 changed files with 171 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
UserReview.MD
View file

@ -2,10 +2,10 @@
Decisions to confirm later. Work continued with guesses in `TODO-With-User.MD`.
1. **System public key custody** — lab Ed25519/X25519 generated into `keys/system/` (gitignored private). Production should be customer HSM. Rotate via signed config + admin-history cube.
2. **Cut over `PFC_REQUIRE_NPE=1` on ns1** — still not this round. `/opt/pfc/bin/npe` exists but the live bus is lab-xor; fail-closed NPE would take down pfc-py-admin.
3. **Caddy hostname** for this hub (`sync.pfc.georgelambert.org` vs a path under `docs.pfc`). Guess: path `/sync/` under existing docs host after CI.
4. **verae org** is empty — leave empty unless you want it as the canonical NATS catalog owner instead of `marchon`.
5. **Website org** — no NATS changes. Confirm if any site should deep-link the endpoint catalog.
6. **Admin console that re-signs config** — PFC console vs peergos-compliance-config TUI. Guess: both may call the same Python `signed_config.sign`; PFC console first. `POST /v1/admin/config` is live; lab login still requires TOTP.
7. **Replication HTTP** — resolved: Go `pfc-repl` coordinator loopback `:18784/health`; ingest replicas stay NATS-only. Old Python `:8782` is unused.
1. **System public key custody** — **lab implemented.** Ed25519 on host `/opt/pfc/etc/sm-keys/` (0600). Rotate: `scripts/rotate_config_key.py` (re-sign + admin-history). NPE: `npe keygen --rotate`. Production HSM/PKCS#11 still hardware-not-present (`docs/HSM-CUSTODY.md`).
2. **`PFC_REQUIRE_NPE=1` on ns1** — **still unset** (bus-wide fail-close would take down pfc-py-admin). Adapter now matches real CLI `npe send|keygen|id` (there is no `npe seal`). Probe: `GET /v1/npe` + health `backends.npe`. Lab identity `/opt/pfc/etc/npe/lab.seed` generated on host.
3. **Caddy hostname `sync.pfc.georgelambert.org`** — **done** (DNS already 70.88.205.138; Caddy root `/opt/pfc/docs/html/sync`). Path `/sync/` on docs.pfc remains.
4. **verae org** — still empty.
5. **Website deep-links** — **done without rewriting 70 repos:** `https://georgelambert.org/pfc/`, console footer, hub `links.html`, docs index.
6. **Admin console re-sign** — `POST /v1/admin/config` live; TOTP required.
7. **Replication HTTP** — resolved (`:18784/health`).